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I .  INTRODUCTION 


Research  in  expert  systems  is  concerned  with  how  to  represent  and 
reproduce  the  problem-solving  skills  that  experts  exhibit  in  their 
respective  domains.  One  of  the  most  basic  of  these  skills  is  the 
ability  to  put  two  and  two  together--to  draw  reasoned  conclusions  that 
supplement  direct  observations.  This  poses  a  difficulty  because  our 
models  of  reasoning  are  derived  from  the  deduction  mechanisms  of  logic 
and,  almost  without  exception,  investigators  have  noted  that  expert 
reasoning  beyond  a  superficial  level  cannot  be  understood  in  terms  of 
such  precise  schema.  Logic  deals  with  an  idealized  world  in  which  facts 
are  known  with  certainty  and  rules  of  inference  allow  other  facts  to  be 
deduced  with  equal  certainty.  Experts,  on  the  other  hand,  are  usually 
required  to  form  judgments  based  on  evidence.  Such  evidence  may  be 
subject  to  uncertainties  arising  from  errors  of  measurement  or 
difficulty  of  interpretation.  The  argument  that  justifies  a  conclusion 
in  terms  of  the  evidence  may  also  be  more  tenuous  than  a  syllogism. 
Again,  experts  can  operate  in  environments  containing  inconsistent  or 
contradictory  "facts,"  but  such  environments  are  useless  in  the  logical 
sense  because  a  set  of  propositions  that  includes  implicitly  both  the 


affirmation  and  the  denial  of  a  proposition  can  be  used  to  prove 
anything  whatsoever. 

The  study  of  how  to  overcome  difficulties  such  as  inconsistency  and 
lack  of  definitiveness  and  still  reach  reasonable,  supportable 


conclusions  is  called  plausible  or  uncertain  inference .  Systems 


developed  for  this  task  typically  operate  in  a  zeroth-o/rder  world  of  llty C  d 
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propositions  and  relations  among  them,  where  the  "zeroth-order"  means 
that  propositions  are  unquantified  or  atomic.  Propositions  may  be 
interpreted  as  facts  ("the  car  won't  start"),  hypotheses  ("the  trouble 
is  in  the  ignition  system"),  findings  ("the  distributor  cap  is 
defective"),  or  any  concept  in  the  domain  that  is  relevant  to  the 
expert's  problem-solving  behavior.  Relations  connecting  subsets  of  the 
propositions  are  usually  expressed  as  logical  definitions  ("A  is  the 
conjunction  of  B,  C,  and  D")  or  inferential  links  ("if  A  is  true,  then 
so  is  B").  The  feature  that  distinguishes  uncertain  inference  from  the 
familiar  propositional  calculus  is  the  qualified  nature  of  knowledge 
about  both  the  relations  and  propositions.  Propositions  have  associated 
with  them  some  (usually  continuous)  measure  of  their  validity  instead  of 
being  either  true  or  false.  Inferential  relations  also  have  a  validity 
measure  that  weakens  the  connection  between  antecedent  and  consequent; 
the  relation  "if  A,  then  B"  may  support  a  less-than-categorical 
affirmation  of  B  even  when  A  is  known  with  certainty. 

A  useful  way  of  viewing  this  formalism  is  as  an  inference  net 
[Hayes-Roth,  Waterman,  and  Lenat,  1978;  Duda ,  Gaschnig,  and  Hart,  1979; 
Gaschnig,  1981].  The  propositions  are  represented  as  nodes  and  the 
relations  among  propositions  become  the  links  of  the  network.  Whenever 
the  validity  measure  of  a  node  is  changed,  such  as  by  the  arrival  of  new 
evidence,  this  information  propagates  along  the  links  to  related  nodes 
and  may  cause  changes  to  their  validity  measures  in  turn.  The  secondary- 
changes  propagate  in  the  same  way  so  that,  when  the  net  stabilizes 
again,  the  evidence  responsible  for  the  initial  change  may  be  reflected 
in  altered  validity  measures  of  many  propositions  or,  to  put  it  another 
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way,  all  the  inferences  that  can  be  made  from  that  evidence  have  been 
made . 

The  general  inference  net  framework,  does  not  address  the  important 
questions  of  how  validity  is  to  be  represented  and  how  the  propagation 
above  is  to  be  carried  out.  Some  approaches  measure  the  validity  of  a 
proposition  as  its  posterior  probability  or  likelihood  given  all  the 
evidence  to  hand,  and  use  Bayes'  Theorem  together  with  various 
assumptions  to  compute  this  likelihood.  Others  use  probability 
intervals  rather  than  values  as  a  measure  of  validity,  relying  on  more 
general  schemes  of  updating  such  as  the  Dempster-Shafer  theory  of 
evidence  [Barnett,  1981;  Garvey,  Lowrance,  and  Fischler,  1981].  It  is 
not  uncommon  for  the  form  of  the  inference  net  to  be  restricted;  for 
example,  [Pearl,  1982]  requires  that  it  be  a  tree.  Many  systems  treat 
the  links  representing  relations  as  directional,  so  that  the  relation 
"if  A,  then  B"  allows  updating  of  B's  validity  when  A  is  known  to  be 
true  but  does  not  allow  A's  validity  to  be  altered  if  B  is  found  to  be 
false.  A  review  and  critique  of  the  more  common  approaches  can  be  found 
in  [Quinlan,  1982].  The  account  of  two  current  systems  that  appears  later 
in  this  paper  should  convey  some  feel  for  the  techniques  used. 

Quite  a  few  expert  systems  embodying  mechanisms  for  uncertain 
inference  have  achieved  notable  successes,  as  exemplified  by  two  of  the 
pioneering  efforts.  MYC1N  [Shortliffe  and  Buchanan,  1975],  an  early 
program  that  diagnosed  bacterial  infections  and  prescribed  appropriate 
antibiotic  therapy,  was  rated  highly  by  a  panel  of  experts  [Buchanan, 

1982]  and  its  general-purpose  successor  EMYCIN  [van  Melle,  1979,  1980] 
has  formed  the  basis  of  many  expert  systems.  A  recent  article 


.  -4- 


(Campbell,  Hollister,  Duda  and  Hart,  1982)  reporting  a  verified  strike 
by  Prospector,  SRl's  geological  consultant  program,  attracted  widespread 
news  coverage.  Despite  these  and  other  achievements,  there  appear  to  be 
applications  requiring  an  uncertain  inference  capability  that  are  not 
handled  well  by  any  current  system.  The  characteristics  of  these 
applications  are  discussed  in  later  sections,  but  the  gist  of  the 
difficulty  and  the  proposed  solution  can  be  obtained  from  the  following 
example . 

Consider  the  task  of  a  fictional  detective  investigating  a  case  in 
which  (as  usual)  there  are  many  apparent  contradictions  in  the  evidence 
that  he  unearths .  How  is  he  to  proceed?  Current  approaches  to 
plausible  inference  would  have  him  weigh  evidence  for  and  against  each 
hypothesis,  consideting  the  hypothesis  confirmed  to  the  extent  that  the 
balance  of  evidence  supports  it.  But  any  mystery  buff  knows  that  this 
approach  differs  from  the  one  Poirot  would  adopt,  and  might  even  lead  to 
the  anomalous  situation  in  which  the  balance  of  evidence  individually 
supports  propositions  A  and  B,  but  where  A  and  B  cannot  both  have 
occurred.  This  paper  suggests  an  alternative  method  of  forming 
conclusions  that  our  detective  would  find  more  familiar  Instead  of 
making  deductions  from  contradictory  information,  we  divide  the  evidence 
into  two  classes,  items  to  be  believed  and  items  to  be  disregarded,  so 
that  all  the  evidence  in  the  former  category  is  consistent  and  "makes 
sense."  Where  there  are  many  possible  divisions  we  use  some  model  to 
weigh  the  validity,  not  of  individual  propositions,  but  of  the  division 
itself.  For  example,  a  division  that  would  require  our  detective  to 
disregard  significantly  more  data  than  another  might  be  judged  to  be 
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lcss  valuable.  Regardless  of  how  the  divisions  are  evaluated,  drawing 
conclusions  only  from  one  or  more  of  these  consistent  subsets  has  the 
effect  of  giving  precedence  to  global  considerations  over  the  more  local 
assessment  of  individual  hypotheses. 

The  paper  is  organized  as  follows:  Section  II  sets  out  a  seemingly 
simple  uncertain  inference  problem.  Section  III  sketches  Prospector  as 
an  example  of  a  directed  Bayesian  architecture,  shows  that  the  problem 
must  be  redrafted  to  fit  the  Prospector  formalism,  and  discusses  the 
difficulties  of  interpreting  the  findings  for  this  case.  Section  IV 
describes  INFERNO,  a  non-directed  non-Bayesian  architecture  sensitive  to 
the  consistency  of  information,  and  shows  that  it  is  also  less  than 
satisfactory  for  this  task.  Section  V  introduces  a  new  system  called 
Ponderosa  that  performs  uncertain  inference  by  evidence  division  rather 
than  by  propagation  of  validity.  The  final  section  summarizes  the  paper 
and  speculates  on  the  possibility  of  merging  two  approaches. 
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II.  DESCRIPTION  OF  THE  TRIAL  APPLICATION 


The  setting  for  this  application  of  uncertain  inference  is  an 
attempt  tc  model  the  interactions  among  five  econometric  indicators.  We 
are  given  several  assertions  concerning  both  general  relationships  aaiouj 
the  indicators  and  predictions  about  what  will  happen  in  the  neat 
future.  The  goal  is  to  draw  meaningful  inferences  from  Lhese  assertions 
so  as  to  arrive  at  a  composite  picture  of  what  will  happen  to  all  the 
indicators . 

Table  T1  contains  the  ten  assertions  that  define  the  model.1 
Numbers  in  brackets  following  assertions  are  validity  measures  in  the 
range  0  to  1 ;  where  there  are  two  such  numbers  following  an  assertion 
they  correspond  to  the  "if"  and  "only  if"  cases  respectively.  Since  we 
have  not  defined  what  we  mean  by  "validity",  the  precise  interpretation 
of  those  numbers  is  open.  It  is  intended  that  a  proposition  or  relation 
with  validity  1  be  equivalent  to  a  categorical  assertion  and  that  one 
with  validity  0  be  totally  vacuous.  We  will  accept  any  of  the  different 
meanings  of  a  middle-ground  validity  that  are  used  in  current  systems. 

The  model  is  typical  of  real-world  applications  in  form  if  not  in 
content.  The  validities  of  the  assertions  or  beliefs  range  from  very 
weak  (as  in  Al)  to  near-categorical  (as  in  A8  and  A9).  Assertions  like 
A4  that  relate  directly  to  an  indicator  of  interest  are  relatively 
uncertain,  but  it  is  often  possible  to  make  a  stronger  statement  about  a 
less  interesting  proposition  as  illustrated  by  A3. 

!  This  model  was  derived  from  an  exercise  in  a  Mathematical  Logic 
text;  any  resemblance  to  any  theory  of  Economics,  past  or  present,  is 
purely  coincidental. 
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Table  T1 

ASSERTIONS  DEFINING  THE  MODEL 

A1  Stocks  will  fall  [ .55 J 

A2  Either  taxes  will  not  be  raised  or  both  stocks  will  fall  and 
interest  rates  will  fall  [.85] 

A3  Either  taxes  will  be  raised  or  interest  rates  will  not  fall  [.9] 
A4  Interest  rates  won't  fall  [.75] 

A5  Either  taxes  will  be  raised  or  there  will  be  a  high  deficit  [.85] 

At)  Bonds  will  rise  or  interest  rates  will  fall  if,  and  only  if, 

stocks  fall  or  taxes  are  net  raised  [.6,. 85] 

A7  Stocks  will  fall  if,  and  only  if,  bonds  rise  and  taxes  are 
raised  [ . 7 , . 8 ] 

A8  if  interest  rates  fall,  either  stocks  will  not  fall  or  bonds 
won  1 1  rise  ( . 95 ] 

A9  Interest  rates  will  not  fall  if  there  is  a  high  deficit  [-95] 

A10  If  there  is  a  high  deficit,  stocks  will  fall  [.8] 

The  application  maps  directly  into  the  zeroth-order  formalism 
described  in  Sec.  I.  There  are  five  basic  propositions  corresponding  to 
the  indicators  of  primary  concern, 

•  stocks  will  fall 

•  interest  rates  will  fall 

•  taxes  will  be  raised 

•  bonds  will  rise 

•  there  will  be  a  high  deficit 

We  have  also  a  small  number  of  derived  propositions  stated  as  logical 
combinations  of  these  basic  propos i t ions ,  such  as  "bonds  will  rise  or 
interest  rates  will  fall."  Each  such  derived  proposition  is  defined  by 
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onc  or  more  logical  relations,  e.g.,  that  the  above  is  the  disjunction  of 
"bonds  will  rise"  and  "interest  rates  will  fall."  Assertions  A1  through 
A5  each  provides  evidence  in  the  form  of  a  validity  for  one  of  the  basic 
or  derived  propositions.  Each  of  the  last  five  assertions  becomes 
either  one  or  two  inferential  relations.  All  in  all  there  are  lb 
propositions,  7  inferential  relations  and  12  logical  relations. 

Despite  the  simplicity  of  this  model,  it  may  not  be  immediately 
apparent  that  the  information  in  the  assertions  is  inconsistent.  A1  and 
A7 ,  for  example,  jointly  support  the  inference  that  taxes  will  be 
raised,  while  assertions  A2  and  A4  together  suggest  that  taxes  will  not 
be  raised.  In  the  logical  sense,  therefore,  this  collection  ot 
assertions  is  of  no  value  because  anything  at  all  can  be  inferred  from 
it  via  the  tautology  A  ->  (~A  ->  B).  However,  it  seems  that  most 
plausible  reasoning  tasks  involve  inconsistent  information  so  that  the 
example  is  not  an  unfair  one. 
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III .  PROSPECTOR 

Prospector  [Duda,  Hart,  and  Nilsson,  1976;  Duda ,  Hart,  Nilsson, 
Roboh,  Slocum,  and  Sutherland,  1977;  Gaschnig,  1980,  1981]  is  a 
general-purpose  architecture  for  uncertain  inference  that  has  been  used 
with  several  geological  models  and  whose  basic  approach  has  been  taken 
up  by  other  systems  such  as  AL/X  [Reiter,  1980,  1981;  Paterson,  1981). 

It  is  therefore  representative  of  a  wel 1 -developed  school  of  thought 
about  uncertain  inference. 

OVERVIEW  OF  PROSPECTOR 

Prospector  and  other  Bayesian  systems  model  the  validity  of  a 
proposition  by  its  posterior  probability  given  the  evidence  at  hand. 

Let  H  be  some  proposition  about  which  inferences  are  to  be  drawn  and  E 
another  proposition.  Bayes'  theorem  gives  the  posterior  probability  (or 
likelihood)  of  H  given  E  as 

P(H!F.)  =  P  ( E  ,  H )  x  P(H  )  /  P(E) 

where  P(E)  and  P(H)  are  prior  probabilities,  and  correspondingly 
P(~H | E)  =  P(£ | ~H)  x  P(~H)  /  P(E) 

Assuming  that  the  latter  is  non-zero,  we  can  divide  the  first  equation 
by  the  second  to  obtain 

0(H ! E )  =  0(H)  x  [ P(E | H)  /  P(E | ~H) ] 

which  may  be  stated  as,  the  posterior  odds  of  H  is  its  prior  odds 
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multipliod  by  a  factor  (.called  X)  that  character  i/.es  the  sui  1  ic  leiicy  of 
E  as  a  predictor  of  H.  A  similar  analysis  can  be  performed  repl u- iug  i'. 
by  ~E  in  the  above,  and  the  corresponding  i actor  X1  characterizes  tin- 
necessity  of  E  it  H  is  to  hold. 

1 nfortunat e 1 y ,  this  formalism  is  insufficient  by  itself  to 
determine  what  should  happen  to  the  otitis  of  H  when  sever. ti  propositions 
E.,  E0,  ...  art'  relevant  to  it,  or  when  the  E's  are  known  with  less 

than  certainty.  The  approach  taken  in  Prospector  is  to  make  two 
add :t  Lo’tal  assumptions:2 

!  i*  'nd  it  ional  independence)  The  probability  PtE  .  11, E  s  of  E  given 

i  j  l 

H  and  IT  is  equal  to  P(E.|H),  and  similarly  tor  ~H. 

(  interpolat  ion)  The  effective  multiplying  l  i  lor  to  use  when  !'.  j 

known  with  less  than  certainty  is  obtained  from  a  piecewise  linear 

in te  rpo lat ion : 

If  the  observed  probability  of  E ^  is  greater  that,  i-s  prior 

probability,  interpolate  the  posterior  probability  of  H  botwee 

P(H)  and  P(H!E.) 

Otherwise,  interpolate  between  P(H)  and  P(H  ~E.) 

In  either  case  the  effective  multiplying  factor  is  the  interpoiati 

posterior  odds  of  H  divided  by  its  prior  odds. 

2  Pednault,  Zucker,  and  Muresan  (1981)  and  Szolovits  and  Pauker 
(1980)  have  commented  on  the  inappropr  i  at  eness  of  these  assumptions, 
particularly  the  first.  Konolige  |Konolige  1982;  bud  i ,  H  irt  ,  i'onolig  . 
and  Reboh ,  1979]  has  developed  an  appealing  scheme  it.  which  these  as¬ 
sumptions  are  replaced  by  a  single  unifying  issumption:  that  the  paste 
rior  distribution  chosen  should  contain  minimal  information  while  still 
conforming  to  user-specified  constraints  on  marginal  and  conditional 
probabi 1  it ies . 
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1' ruler  these  assumptions,  the  posterior  odds  of  proposition  H  is  sim[)ly 
the  product  of  its  prior  odds  and  the  effective  multiplying  factors 

obtained  as  above  for  each  F. .  . 

1 

Inferential  links  from  one  proposition  to  another  can  thus  be 
implemented  by  choosing  appropriate  values  for  the  factors  X  and  X'. 
Prospector  allows  logical  relations  among  propositions  as  follows: 

•  I f  A  is  the  negation  of  B,  the  odds  of  A  is  the  reciprocal  of 
the  odds  of  B. 

•  I f  A  is  the  disjunction  of  ,  the  odds  of  A  is  the 

maximum  of  the  odds  of  any  B^. 

•  If  A  is  the  conjunction  of  BJ(  B0 .  the  odds  of  A  is  the 

minimum  of  the  odds  of  any  B^. 

Prospector's  control  structure  comes  from  its  intended  application 
is  a  consultation-style  system.  Each  relation  can  cause  the  odds  of 
only  one  proposition  to  be  altered  directly;  inferential  relations  "if 
F. ,  tin  n  H"  as  before  affect  only  H,  and  logical  relations  as  above 
affect  only  A.  Accordingly,  the  links  representing  relations  are 
thought  of  as  directed  into  the  affected  proposition.  Prospector 
requires  that  there  be  no  cycles  in  the  corresponding  inference  net  and 
allows  observed  probabilities  to  be  given  only  for  "evidence" 
propositions  that  have  no  links  directed  into  them. 


APP LYING  PROSPECTOR  TO  THE  MODEL 

Seveial  difficulties  arise  when  we  attempt  to  use  the  Prospector 
architecture  for  the  task  described  in  Sec.  II.  The  more  serious  of 
these  are  consequences  of  Prospector's  tacit  assumption  that 
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propositions  can  bo  arranged  in  a  hierarchy  w ith  inference  chains 
flowing  smoothly  from  raw  evidence  through  to  conclusions. 

Consider,  for  example,  the  proposition  "stocks  will  fall." 

Assertion  A1  establishes  this  proposition  as  Icing  true  with  some 
validity,  implying  that  this  proposition  is  evidence.  Several  other 
assertions,  however,  establish  conditions  under  which  the  proposition 
can  be  inferred  to  be  true,  thus  establishing  inferential  links  to  the 
proposition  and  so  preventing  it  from  being  evidence.  Again,  assertions 
A2,  A2 ,  and  A5  establish  that  certain  logical  combinations  of 
propositions  are  valid,  and  Prospector  contains  no  mechanism  that  would 
allow  evidence  to  bear  directly  on  such  propositions.  Similar  problems 
arise  from  Ac,  A7 ,  a:.'  AS,  where  logical  combinations  are  on  the 
receiving  end  of  the  inferential  links. 

Tlie  steps  taken  to  reformulate  the  example  are  as  follows:  (1)  The 
two  propositions  "stocks  will  fall"  and  "interest  rates  will  fall”  that 
appear  both  as  evidence  and  as  potential  conclusions  are  represented 
each  by  two  nodes  in  the  net.  The  first  node  is  a  conventional  evidence 
node  with  a  very  strong  inferential  link  to  the  second  copy  that  is  also 
the  recipient  of  other  inferential  links.  (2)  Assertions  such  as  A2  of 
the  form  "A  or  B"  are  represented  functionally  as  the  pair  of  inference 
relations  "if  A  is  false,  then  B"  and  "if  B  is  false,  then  A."  (3) 

Complex  assertions  are  broken  down  into  more  primitive  relations  that 
have  i  single  proposition  as  the  inference.  For  example,  A6 ,  of  the 
form  "A  or  B  if,  and  only  if,  C  or  D,"  becomes  the  set  of  relations: 

If  (A  or  B)  and  ~C,  thcr.  D 

If  (A  or  B)  and  ~D,  then  C 
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If  ~A  and  ~B ,  then  ~C 
If  ~A  and  ~B ,  then  ~D 


(A)  Finally,  all  prior  probabilities  are  taken  by  default  as  0.5  since 
the  example  does  not  specify  other  values,  and  the  strengths  of  the 
multipliers  X  and  X'  are  determined  so  that,  if  the  relation  "if  A,  then 
B"  has  validity  V,  the  posterior  probability  of  proposition  B  given  A  is 
also  V. 

Table  T2  lists  the  Prospector-style  inferential  relations  that  this 
reformulation  produces,  together  with  their  multiplying  factors  X  and 


Table  T2 

INFERENTIAL  LINKS  IN  PROSPECTOR  FORM 


To 

From 

X. 

V 

Source 

stocks  - 

same  (evidence) 

10,000 

0 

.0001 

taxes+ 

5.67 

1 

A2 

(bonds+  v  interest-)  &  taxes+ 

5.67 

1 

A6 

~bonds+  &  -interest- 

0.67 

1 

A6 

interest-  &  bonds+ 

0.05 

1 

A8 

high  deficit 

4.00 

1 

A10 

interest- 

same  (evidence) 

10,000 

0. 

.0001 

high  deficit 

0.05 

1 

A9 

taxes+ 

5.67 

0.11 

A2 ,  A3 

taxes+ 

stocks- 

4.0 

0.18 

A2,A7 

interest- 

9.0 

0.18 

A2 ,  A3 

high  deficit 

1 

5.67 

A5 

(bonds+  v  interest-)  &  -stocks- 

0.18 

1 

A6 

~bonds+  h  -interest- 

1.5 

1 

A6 

-stocks-  &  bonds+ 

0.43 

1 

A7 

bonds+ 

stocks - 

4.0 

1 

A7 

interest-  &  stocks- 

0.05 

1 

A8 

-stocks-  i  taxes+ 

0.43 

1 

A7 

high  deficit 

taxes+ 

1 

5.67 

A5 

r 
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X'.  The  final  column  of  the  Table  shows  the  assortion(s)  responsible 
for  each  link.  At  this  point  a  serious  flaw  becomes  evident --the 
network  of  propositions  and  relations  contains  cycles  ai.d  so  violates 
another  Prospector  requirement.  The  cycles  are  the  result  of  strong 
interconnections  among  the  five  indicators,  however,  and  there  seems  to 
be  no  way  of  eliminating  them.  Rather  than  abandon  the  enterprise 
forthwith,  we  will  generalize  the  Prospector  algorithm  to  allow 
computation  of  posterioi  probabi 1  it  ies  by  relaxation,  terminating  when 
changes  are  small  so  that  the  cycles  will  not  cause  infinite  loops. 

A  Prospector- 1  ike  system  embodying  this  change  was  used  to  obtain 
the  results  shown  in  Table  T3.  (Since  a  relaxation  algorithm  was  used, 
there  is  no  guarantee  that  this  is  the  only  set  of  posterior 
probabilities  that  is  stable;  reordering  of  the  computational  steps 
could  give  rise  to  a  different  solution.)  Although  they  appear'  to  be  the 
kind  of  results  that  are  commonly  obtained  from  plausible  inference 
systems,  they  are  deficient  in  at  least  two  respects.  First,  they  do 
not  highlight  the  fact,  noted  in  Sec.  II,  that  the  set  of  assertions 
from  which  the  model  was  derived  is  internally  inconsistent.  The 

Table  T3 

RESULTS  FROM  A  PROSPECTOR -STYLE  SYSTEM 

Posterior  Categorical 


Propos it  ion 

Probabi 1 ity 

Interpretat ion 

stocks  will  fall 

.64 

T 

interest  rates  will  fall 

.08 

F 

taxes  will  be  raised 

.27 

F 

bonds  will  rise 

.59 

T 

there  will  be  a  high  deficit 

.66 

T 

f 


-15- 


assumptions  that  Prospector  makes  will  never  produce  an  overconstrainod 
system,  so  any  collection  of  evidence  and  relations  will  lead  to  a 
solution.  Hut  Michie  (19S0,  1982)  argues  convincingly  that  practical 
expert  systems  must  be  user-friendly,  and  therefore,  out  of  concern  for 
tlie  validation  and  intelligibility  of  results,  iL  would  seem  that 
consistency  checking  ought  to  be  one  of  their  more  important  functions. 
Second,  the  statement  of  a  result  as  a  probability  is  fine  when  there  is 
only  one  result  of  interest,  but  can  lead  to  problems  in  cases  such  as 
this  when  we  need  a  simultaneous  reading  of  several  variables.  Suppose 
that  the  mode!  builder  wished  tc  predict  the  most  likely  future  state 
from  the  2  5  possible  in  terms  of  the  five  indicators.  Converting  the 
probabilities  to  categorical  form  by  threshholding  as  in  Table  T3  would 
lead  to  the  conclusion  that 

stocks  will  fall; 

interest  rates  will  not  fall; 

taxes  will  not  be  raised; 

bonds  will  rise;  and 

there  will  be  a  high  deficit. 

These  conclusions  may  be  individually  unsurprising  but  in  combination 
they  violate  the  "only  if"  part  of  assertion  A7.  This  relation  has  a 
relatively  high  validity  of  0.8  and  so  any  conclusion  that  disregards  it 
is  suspect.  Thus  mapping  from  probabilistic  to  categorical  results  for 
several  variables  (when  called  for  by  the  application)  may  produce 
conclusions  that  do  not  fit  with  the  evidence. 

In  summary,  in  order  to  run  our  example  on  Prospector  we  had  to 
make  significant  alterations  to  the  formulation  of  the  model  and  to 
modify  Prospector  as  well;  even  so,  the  results  we  obtained  were 
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deficient.  For  all  these  reasons  it  would  seem  that  Prospector  is  not 
well-suited  to  this  application. 
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IV.  INFERNO 

INFERNO  [Quinlan,  1982]  is  another  inference  network  system  that 
was  designed  around  four  ideas: 

1.  General  systems  for  uncertain  inference  are  better  off  without 
assumptions  such  as  conditional  independence  whose  universal 
validity  is  suspect. 

2.  On  the  other  hand,  it  should  be  possible  to  assert  that 
particular  groups  of  propositions  exhibit  relationships  such  as 
independence . 

3.  There  should  be  no  restrictions  on  the  direction  of  information 
flow  in  the  network.  (This  was  the  cause  of  much  of 
Prospector's  difficulty  with  the  example  of  Sec.  II.) 

4.  The  consistency  of  the  given  information  should  be  checked  and 
the  system  should  be  able  to  advise  on  alternative  methods  of 
rectifying  inconsistencies. 

The  effect  of  these  requirements  has  been  to  lead  away  from  Prospector- 
style  formalisms. 

DESCRIPTION  OF  INFERNO 

The  first  difference  comes  in  the  way  that  the  validity  of  a 
proposition  is  represented.  Instead  of  a  single  point  probability, 
INFERNO  uses  probability  bounds  similar  to  the  interval  approach  of  the 
Dempster-Shafer  Theory  of  Evidence  [Barnett,  1981;  Garvey  et  al.,  1981]. 
Every  proposition  A  is  characterized  by  a  lower  bound  t(AJ  on  the 
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probability  l’(A)  of  A  and  a  lower  bound  f(A)  on  l’(~Al,  so  that 

t  ( A)  <  1’ (. A 1  <  1  -  f  ( A)  . 

This  approach  lias  two  features.  Tin;  uncertainly  of  oui  knowledge  about. 

A  is  apparent,  being  just  the  difference  between  1(A)  and  1  -  { i A < . 
Second,  the  values  of  t:.\)  and  are  derived  froa:  evidence  tending  t  c » 

support  and  to  deny  A  respectively,  ami  these  values  are  retained  and 
propagated  separately. 

To  achieve  the  non-directod  propagation  of  inference',  as  in  point 
(3)  above,  INFERNO  follows  WAND  | Hayes -Roth ,  1981)  in  viewing  relations 
as  establishing  constraints  on  the  respective  validities  of  col  loot  ions 
of  propos it  ions .  Changing  a  probability  bound  of  any  proposition  ir:  the 
collection  may  cause  the  constraint  to  be  violated,  requiring  some  other 
bound  to  be  altered.  For  example,  one  form  of  inferential  relation, 
written  as 


A  enables  B  with  strength  X 

is  intended  to  capture  the  (uncertain)  relation  "if  A,  then  B."  This 
relation  has  two  constraints  associated  with  it: 

t (B )  >  t(A)  x  X 

f (A)  >  1  -  (1  -  f (B) )  /  X 

and  thus  can  cause  t(B)  to  be  increased  when  t ( A )  is  increased,  or  t(A) 
to  be  increased  when  f(B)  is  increased.  Logical  connections  among 
propositions  are  handled  in  the  same  manner.  The  relation  defining  A  as 
the  conjunction  of  B^,  B0,  ...  ,  gives  four  constraints:  for  all  B., 
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t (A)  >  1  -  Z.(l  -  t(B.)) 

f (A)  >  f(B.) 

t(B.)  >  t (A) 

f  (B  .  1  >  f(A)-Z...(l-tfB.n 

a  J  *  i  J 

These  and  all  other  INFERNO  constraints  can  be  derived  from  simple 
probability  identities  and  do  not  depend  on  other  assumptions. 

This  representation  also  supports  a  probabilistic  concept  of 
consistency.  If  t(A)  +  f(A)  >  1  for  some  proposition  A,  the  information 
about  A  is  inconsistent  and  one  or  both  of  the  bounds  must  be  incorrect. 
Since  the  propagation  constraints  are  provably  correct,  the 
inconsistency  can  only  arise  from  contradictions  implicit  in  the 
information  given  to  the  system.  INFERNO  can  suggest  ways  to  alter  the 
data  so  as  to  make  it  consistent.  A  change  takes  the  form  of  lowering 
the  given  value  of  a  bound  or  reducing  the  strength  of  one  of  the 
inferential  relations.  A  combination  of  changes  that  is  sufficient  to 
make  the  bounds  on  all  propositions  consistent  is  called  a 
rect i f icat ion .  INFERNO  can  generate  the  best  n  of  the  possible 
rectifications,  ranking  them  under  the  assumption  that  those  involving 
the  least  alteration  of  the  original  data  are  more  likely  to  be 
acceptable . 

APPLYING  INFERNO  TO  THE  MODEL 

When  we  wished  to  app'y  Prospector  to  the  task  of  Sec.  II  wc  first 
had  to  reformulate  it  to  conform  to  Prospector's  architectural 
restrictions.  INFERNO  doe.  not  impose  any  such  restrictions  and  the 
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example  can  be  run  in  its  original  form. 


-:■<>- 


INFERNO  1  mmcd  i  ,it  e ly  1  inds  the  sot  o  I  assertions  to  bo  inconsistent. 
The  explains!  ion  01  one  such  inconsistency  serves  also  to  illiu.tr ate  the 
propagation  of  bounds  in  the  system.  It  helps  to  remember  in  the 
following  that  1NFKRN0  is  again  using  probability  as  a  model  of 
validity. 


•  Assertion  A1  of  Table  T1  is  that  stocks  will  fall  with 
probability  .55,  and  A?  states  (with  strength  .8)  that  this 
will  happen  only  if  bonds  rise  and  taxes  are  raised.  The 
conclusion  is  that  the  probability  of  bunds  rising  and  taxes 
being  raised  is  at  least  .8  x  .55,  or  .44. 

•  Clearly,  the  probability  of  one  component  of  this  conjunction, 
taxes  being  raised,  must  also  be  at  least  .44,  so  the 
probability  that  taxes  will  not  be  raised  is  at  most  .56. 

•  Assertion  A2  gives  the.  probability  that  taxes  will  not  be 
raised  01  stocks  will  fall  and  interest  rates  will  fall  as  .83, 
the  probability  of  the  first  term  of  the  disjunction  is  at  most 
.56,  so  the  probability  that  stocks  will  fall  and  interest 
rates  will  fall  is  at  least  .29. 

•  The  probability  that  interest  rates  will  fall  must  therefore  he 
at  least  .29,  but  (by  A4 )  the  probability  is  at  most  .25. 

INFERNO's  analysis  of  the  various  interdependencies  then  leads  it  to 
propose  four  alternative  rectifications,  each  of  which  will  correct  the 
above  and  all  other  inconsistencies.  Eacii  rectification  consists  of  a 
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single  change: 

•  Reduce  the  probability  that  interest  rates  will  not  fall 
(assertion  A4)  to  .71. 

•  Reduce  the  probability  of  assertion  A2  to  .81. 

•  Reduce  the  probability  that  stocks  will  fall  (assertion  Al)  to  .5. 

•  Weaken  the  only-if  strength  of  assertion  A7  to  .727. 

This  s'  rt  of  consistency  analysis  is  intended  to  permit  the  user  to 
review  selected  fragments  of  the  information  that  he  presented  to  the 
system  with  an  eye  to  making  it  consistent  before  trusting  conclusions 
based  on  it.  He  has  the  option  of  ignoring  the  inconsistencies  if  he 
wishes,  as  he  might  well  do  in  this  case  since  the  probability  bounds 
are  in  only  marginal  conflict. 

Let  us  suppose,  though,  that  he  elects  to  remove  the 
inconsistencies  by  disregarding  completely  the  assertion  Al  that  stocks 
will  fall;  it  was  after  all  a  relatively  weak  belief  according  to  its 
validity  measure.  The  consistent  set  of  probability  bounds  that  INFF.RNO 
obtains  from  A2  through  A10  is  shown  in  Table  T4.  In  general  it  is  more 
difficult  to  place  a  categorical  interpretation  on  INFERNO’s  ranges  than 

Table  T4 

RESULTS  FROM  INFERNO 

Probability  Categorical 


Proposition 

Range 

Interpretation 

stocks  will  fall 

.36  - 

.5 

F 

interest  rates  will  fall 

.138  - 

.25 

F 

taxes  will  be  raised 

.288  - 

.4 

F 

bonds  will  rise 

.288  - 

1 

7 

there  will  be  a  high  deficit 

.45  - 

.625 

T 

i 
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it  was  in  the  case  of  Prospector's  single  probabilities,  but  in  this 
instance  the  mapping  to  {T,?,F}  seems  reasonable.  Notice,  though,  that 
the  categorical  interpretation  again  violates  a  relatively  strong 
relation  ( A 1 0 )  predicting  that  stocks  will  fall  if  there  is  a  high 
def icit ! 

To  summarize:  INFERNO  avoids  three  of  the  four  difficulties  that 
Prospector  experienced  with  the  model.  It  allows  assertions  and 
inferences  about  logical  combinations  of  propositions  and  is  not  put  out 
by  cycles  in  the  net.  It  also  makes  apparent  any  inconsistencies  in  the 
information  presented  to  it  and  provides  ho.lpful  aids  to  reviewing  the 
information.  However,  an  attempt  to  place  categorical  interpretations 
on  the  results  can  once  more  lead  to  conclusions  that  are.  not  consistent 


with  the  data. 


relations,  it  does  not  .it tempt  to  propagate  validity  measures  of  any 
kind.  Instead,  it  follows  the  approach  outlined  in  Sec.  1  of  trying  to 
separate  out  from  the  information  given  to  it  one  or  mure  internally 
consistent  subsets.  The  merit  of  any  such  division  is  then  established 
as  a  function  of  tin-  validities  of  assertions  that  were  not  included. 

D e sr.K n >ti ( isj if  ti i e  approach 

Coi.s  ;.ier  a  set  of  assertions  such  as  those  in  Sec.  II.  Each 
assertion  can  be  viewed  as  a  well -formed  formula  fwl'l)  of  the 
propos  i  t  ion  1 1  calculus  wit!;  .1  validity  measure  attached,  or,  in  the  case 
of  tin  "if  and  only  if”  assertions,  a  pair  of  such  formulas.  Let  C  be  a 
sal  >et  of  t  he  ufis,  wheie  we  disregard  for  the  moment  each  wff's 
v.Iid’.tv  measure.  0  is  cons  istent  in  the  logical  sense  if  there  is  no 
wft  that  can  be  both  roved  and  disproved  from  C.5  A  subset  is 
max ima 1 ly  consistent  if  it  is  consistent  but  the  addition  of  any  other 
wff  from  the  original  set  will  make  it  inconsistent. 

Suppose  now  that  the  original  set  of  wffs  has  been  divided  into  a 
maximally  consistent  subset  C  and  the  remainder  R  =  {Rj,  R£ ,  ,  R^}, 

and  let  V(R.)  be  the  validity  measure  of  R  .  One  way  of  assessing  the 

I 

situation  (.which  will  be  called  an  interpretation)  would  be  to  accept 

3  This  notion  of  consistency  is  stronger  than  the  one  used  for  INFER¬ 
NO  in  which  it  is  permissible  to  inter  both  A  and  ~A  so  long  as  the  sum 
of  the  upper  bounds  ol  f’(A)  and  P(~A)  does  not  exceed  1. 
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tho  wffs  in  C  together  with  all  their  (consistent)  inferences  and  to 
ignore  the  wffs  in  R  as  being  either  erroneous  (e.g.,  resulting  from 
faulty  observation)  or  general  default  assertions  that  do  not  apply  in 
this  case.  How  plausible  is  this  interpretation?  If  it  is  to  be 
correct,  each  individual  must  be  incorrect  or  inapplicable.  The 

probability  that  this  interpretation  is  incorrect  is  then  the 
probability  of  the  disjunction  of  the  elements  of  R,  i.e.. 

P(R,  v  R„  v  ...  v  R  ) 

12  n 

If  we  again  treat  validity  measures  as  probabilities  and  use  the. 
identity 


P(A).  P(B)  <  P(A  v  B)  <  P C A )  +  P(B) 
we  obtain  the  probability  P(C,R)  that  the  interpretation  is  correct  as 

1  -  I.  V(R.)  <  P(C,R)  <  min.  (1  -  V(R.)) 

it  ii 

Since  we  are  identifying  validity  measures  with  probabilities,  P(C,R) 
represents  the  validity  of  the  interpretation  dividing  the  original  set 
of  wffs  into  C  and  R. 

Of  course,  the  number  of  potential  splits  of  a  set  of  wffs  into  a 
maximally  consistent  subset  and  a  remainder  grows  exponentially  with  th 
size  of  the  set.  The  validity  measures  attached  to  propositions, 
however,  provide  methods  of  reducing  the  computational  load.  First,  we 
are  clearly  uninterested  in  any  interpretation  whose  validity  is  zero. 
If  any  wff  in  R  has  a  validity  of  1  and  thus  is  categorically  correct, 
the  inequality  above  gives  a  zero  upper  bound  on  the  validity  of  that 
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itiLerpretat  .on.  Consequently,  we  need  consider  only  interpret  at  ions  in 
winch  nil  o  nugor  i«.,il  assert  iutb  arc  included  in  the  consistent  subset 
C.  Second,  we  do  not  wish  to  swanip  the  User  with  all  possible 
divisions,  but  i  ather  to  display  vi.  iy  the  best  a  of  theni  for  some  small, 
fixoci  n  ( current ly  10).  So  we  do  not  need  to  generate  all  possible 
interpretations  provided  that  the  ones  omitted  are  inferior  to  the  ones 
displayed.  Since  the  validity  of  an  interpretation  is  known  only  as  a 
range  and  thus  two  interpretation:.  cannot  be  compared  directly,  the 
midpoint  of  the  range  is  used  for  ranking  them. 

The  -.nnards  of  i’onrfc  r.-sa  can  be  sketched  as  follows. u  Each 
proposition  A  is  broken  into  two  f  hidings  "A  is  true"  and  "A  is  false." 
Associated  witii  each  finding  is  a  collection  of  justif ications  for  the 
finding,  where  a  null  justification  indicates  that  there  is  no  reason  to 
believe  the  finding  Each  justification  for  the  finding  is  either  that 
the  finding  is  an  explicit  assertion  given  to  the  system,  or  that  the 
finding  is  an  inference  from  a  relation  and  one  or  more  other  findings 
with  non -null  just i f i cat  ions .  r..r  instance,  the  finding  "B  is  false" 
and  the  relation  A  implies  B"  together  justify  the  finding  "A  is 
false,"  and  the  logical  relation  "X  is  the  disjunction  of  A  and  B" 
together  with  both  these  findings  justifies  "X  is  false." 

Every  datum  is  either  a  relation  or  an  assumed  finding  and  all 

findings  depend  ultimately  on  the  data.  Ponderosa  keeps  with  each 

ri tiding  c  i .  mova  1  pl_an  in  the  form  of  a  collection  of  sets  of  data,  the 

idea  being  thai  alj  justifications  for  this  finding  would  evaporate  if, 

“  The  algorithms  used  in  the  current  Ponderosa  have  been  heavily  in¬ 
fluenced  by  the  fact  that  it  was  implemented  as  a  rewrite  of  INFERNO, 
and  are  almost  certainly  not  the  best  that  could  be  developed. 
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and  only  if,  any  one  of  these  sets  of  data  were  removed.  The  air/  1 1  lirns 
for  removal  sets  below  depend  on  th<  observation  that  a  removal  plan  is 
isomorphic  to  a  logical  expression  i n  disjunctive  normal  form.  l,et  us 
map  each  datum  D  to  the  predicate  "l)  is  excluded"  and  the  removal  plan 

{  <Dn,D12,. . .},  { r>2  j ,  D22 ...  } 

to  the  logical  expression 

(D^j  is  excluded  and  D ^ 9  is  excluded  and  ...  1 
or  tD?.  is  excluded  and  is  excluded  and  ...  ) 

or  ... 

Then  the  expression  is  true  if,  and  only  it,  one  of  the  sets  of  data 
making  up  the  removal  plan  has  been  discarded,  in  which  case  the  plan  is 
sat isf ied . 

The  computation  of  removal  plans  keeps  pace  with  the  propagation  of 
inferences.  Initially  the  only  findings  with  justifications  are  those 
that  appear  in  the  data,  and  the  removal  plan  tor  such  a  finding  is 
{{itself}}.  Suppose  now  that  a  new  justification  for  finding  F  has  been 
inferred  from  a  relation  R  and  findings  {S^}.  This  justification  could 

be  removed  if  either  R  or  any  of  the  S's  could  be  removed,  as  given  by 
the  plan  (in  disjunctive  form) 

X  =  R  v  removal  plan(S  )  v  removal  plan  (S2)  v  ... 


But  previous  justifications  may  have  been  found  for  F  and  removal  of  F 
would  require  removal  of  them  as  well.  In  this  case,  the  new  removal 
plan  for  F  becomes  the  conjunction  of  the  old  removal  plan  and  X. 


soul  rad  i  e.torv  propositions  {A.}  vli.it  can  bn  both  proved  and  disproved. 


i . e . ,  one  or  more  pairs  of  findings  "A.  is  true"  and  "A.  is  false,"  both 

with  non-null  justi f icat ions  and  removal  plans.  Clearly,  the  data  would 
become  consistent  if,  and  only  if,  one  of  each  such  pair  of  findings 
could  be  lemoved.  When  put  into  disjunctive  norma]  form,  the  removal 
plan  obtained  as  tlu1  conjunction  over  i  of 


removal  plan  ("A.  is  true")  v  removal  plan  i"A.  is  false") 

1  1 

is  then  just  the  set  of  remainders  corresponding  to  all  possible 
maximally  consistent  sets  Ponderosa  computes  this  overall  plan  in  a 
depth-first  way  so  that,  if  a  partial  remainder  is  generated  that  is 
already  more  implausible  than  the  best  n  complete',  remainders  found  so 
far,  all  possible  remainders  containing  the  partial  one  are  omitted. 

As  a  small  but  pathological  illustration  of  all  this,  consider  the 
inconsistent  assertions 


1  .  A  impl  ies  13 

2.  B  implies  C 

3 .  C  impl ies  A 

4 .  A  i s  t  rue 

5.  B  is  true 

6.  C  is  false 


Ponderosa 
as  follow 


notes  the  various  findings  and  their  associated 
,  with  data  referenced  by  the  above  numbers: 


A  is  true: 

A  is  false*: 
B  is  true: 

B  is  false. 

'  s  t  rue 
r.  is  false: 


.3)  ) 


f  {2,4},  (3,4), 

{  U),  { 2 }  ,  (o)  } 

{  (  1  ,  3 1  ,  i  4  ,  i  }  } 

f  {:•},  { e  1  ) 

{  {!.-).  {2),  {4,3}  } 

(  {o}  } 


remova 1 


p  1  ans 


f 
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The  disjunctions  for  each  contradictory  proposition  art;  then 

A:  {  {1},  {2},  {3.4},  {4,5},  {6}  } 

B:  {  {1.5},  {2},  {4,5}.  {6}  } 

C:  {  {1.5}.  {2},  {4,5},  {6}  } 

and  the  conjunction  of  these  representing  all  possible  remainders  is 

{  {1,5},  {2},  {4,5},  {6}  } 

APPLYING  POSDEROSA  TO  THE  MODEL 

As  was  the  case  with  INFERNO,  Ponderosa  contains  no  restrictions 
that  would  require  the  model  of  Sec.  II  to  be  reformulated.  Once  again 
the  information  in  assertions  A1  through  A10  is  found  to  be  inconsistent 
and  Ponderosa  generates  the  six  possible  divisions  oi  the  corresponding 
wffs  into  a  maximally  consistent  subset  and  a  remainder.  The  six 
remainders  are  displayed  in  Table  T5  together  with  the  bounds  on  tin- 
validity  of  the  divisions  and  the  midpoints  of  these  ranges.  Notice 
that,  whereas  INFERNO  would  accept  the  weakening  oi  just  "stocks  will 
fall"  as  sufficient  to  remedy  the  inconsistencies,  Ponderosa  uses  a 
stronger,  categorical  definition  of  consistency  and  finds  that  removal 
of  assertion  A1  alone  is  not  enough. 

Ponderosa  does  not  automatically  select  the  "best"  or  any  other 
maximally  consistent  subset  as  being  correct.  Its  function  stops  with 
pointing  out  to  the  user  the  possibilities  that  exist  for  making  his 
information  consistent,  using  the  validity  ranking  only  as  a  filter  and 
heuristic  guide.  The  user's  specialist  knowledge  may  place  a  value  on 
various  subsets  of  the  information  that  differs  from  this  simple 
plausibility  model.  In  this  instance,  let  us  suppose  that  the  fourth 
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Table  T5 

PONDEROSA  REMAINDERS 


Rema inder 

Low 

Validity 

Mid 

High 

Mb 

stocks-  only  if  bonds+  &  taxes+ 

.2 

.2 

.2 

A2 

~taxes+  v  stocks-  &  interest- 

.  15 

.15 

.  15 

>  > 

4>  H-. 

stocks- 

-interest- 

0 

.  125 

.25 

A1 

A10 

stocks - 

if  high  deficit  then  stocks- 

0 

.  1 

O 

A1 

A5 

stocks - 

taxes+  v  high  deficit 

0 

.075 

.  15 

A4 

-interest- 

0 

.025 

.05 

A8  if  interest-  then  -stocks-  v  -bonds+ 


temainder  (assertions  A1  and  A10)  is  selected  as  the  least  valuable  of 
those  possible.  When  these  assertions  are  deleted,  the  remainder  form  a 
consistent  subset  whose  implications  for  the  five  indicators  appear  in 
Table  T6.  Ponderosa  ignores  the  validity  of  wffs  when  it  generates 
inferences,  so  all  inferences  are  categorical  and  cannot  individually  or 
collectively  fail  to  mesh  with  the  evidence  in  the  consistent  subset. 

Table  T6 

CONSISTENT  INFERENCES 


Proposition  Validity 


stocks  will  fall  F 
interest  rates  will  fall  F 
taxes  will  be  raised  F 
bonds  will  rise  T 
there,  will  be  a  high  deficit  T 


f 
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VI.  CONCLUSION 

This  paper  has  focused  on  a  class  of  plausible  reasoning  rusi-s  u  i  ;  i, 
three  characteristics:  inconsistent  data,  non-hierar>J.iv..il  intei 
of  concepts,  and  the  need  to  obtain  simultaneous  readings  on  mv-a.il 
hypotheses.  A  simple  model  with  these  attributes  was  used  to 
demonstrate  that  existing  systems  for  inexact  inference  are  not  suited 
to  this  kind  of  task.  We  first  examined  Prospector  as  the 
quintessential  example  of  a  Bayesian  system  and  showed  that  both  the 
model  and  Prospector  itself  would  have  to  be  altered  to  get  any  results 
at  all.  Even  then,  the  inconsistency  inherent  in  the  given  model  was 
not  made  evident  and  a  straightforward  interpretation  of  the  results 
turned  out  to  be  at  variance  with  the  model.  INFERNO,  a  more  tolerant 
non-Bayes ian  system,  fared  better  in  that  the  model  did  not  have  to  be 
changed  and  its  inconsistencies  were  discovered,  but  once  more  the 
attempt  to  wring  a  categorical  interpretation  from  the  results  produced 
an  anomaly.  Ponderosa  was  introduced  as  a  system  to  perform  uncertain 
inference  by  finding  consistent  subsets  of  the  model,  leading  to  results 
that  are  always  categorical  and  that  agree  with  whatever  reduced  model 
is  used. 

There  are  clearly  other  classes  of  plausible  reasoning  tasks  to 
which  Ponderosa  is  unsuited.  If  all  the  data  is  consistent  or  if  there 
is  a  single  proposition  about  which  information  is  sought,  the 
probability-bounding  approach  of  INFERNO  gives  a  better  appraisal  of  the 
confidence  with  which  the  results  can  be  accepted.  This  suggests  an 
interesting  possibility  for  combining  the  talents  of  Ponderosa  and 


I 
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INFERNO.  First,  Ponderosa  would  be  used  to  find  whether  the  data  is 
categorically  consistent  and,  if  not,  to  help  the  user  choose  a 
maximally  consistent  subset  of  it.  INFERNO  could  then  be  run  with  this 
subset  to  supplement  Tonderosa's  categorical  inferences  with  probability 
bounds.  For  instance,  in  the  previous  section  we  selected  a  maximally 
consistent  subset  A2  through  AO  of  the  assertions  in  Table  T1 .  The 
analysis  of  this  subset  with  INTERNO  is  shown  in  Table  T7 .  It  now 
becomes  apparent,  that,  while  categorical  inferences  from  the  subset 
justify  both  the  predictions  that  bonds  will  rise  and  that  there  will  be 
.:  high  deficit,  the  former  conclusion  has  weaker  probability  bounds  as  a 
consequence  of  its  derivation  from  less  valid  assertions. 

In  the  abstract  of  their  197S  paper,  Szolovits  and  Paukcr  state 

that 


"..  a  program  which  can  demonstrate  expertise  in  the  area  of 
medical  consultation  will  have  to  use  a  judicious  combination 
of  categorical  and  probabilistic  reasoning- -the  former  to  es¬ 
tablish  a  sufficiently  narrow  context  and  the  latter  to  make 
comparisons  among  hypotheses  and  eventually  to  recommend 
thei apy . " 


Table  T7 

COMBINING  INFERNO  AND  PONDEROSA 


Propos  it  .ion 

Categorical 
Val idity 

Probabi 1 i ty 
Bounds 

stocks  will  fall 

F 

0  - 

.5 

interest  rates  will  fall 

F 

.25  - 

.25 

taxes  will  be  raised 

F 

.  15  - 

.4 

bonds  will  rise 

T 

.11  - 

1 

there  will  he  a  high  deficit 

T 

.45  - 

.  79 

f 
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Their  PIP  system  used  categorical  reasoning  to  generate  hypotheses  whose 
validity  was  then  investigated  probabilistically.  In  some  ways,  the 
proposed  partnership  of  INFERNO  and  Ponderosa  suggests  another  way  of 
arriving  at  the  combined  approach  advocated  above.  Ponderosa  would 
establish  a  context,  in  the  form  of  a  subcollection  of  the  evidence  that 
hangs  together,  within  which  INFERNO  would  be  used  to  carry  out 
probabilistic  reasoning. 

Ponderosa  has  been  implemented  in  Pascal  and  C  for  a  VAX  11/750 
minicomputer,  based  on  a  similar  implementation  of  INFERNO.  The 
prototype  has  been  applied  only  to  small  tasks  with  less  than  100 
relations  and  propositions,  and  on  these  it  is  fast  enough  to  be  useful 
but  considerably  slower  than  INFERNO.  For  comparison,  the  CPU  times 
consumed  by  the  runs  of  Sec.  IV  and  V  were  just  over  one  second  for 
INFERNO  versus  about  6  seconds  for  Ponderosa. 
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